Gemini 4 Carbon Cybersecurity: The 33-Point Gap Google Didn’t Explain

Google says Gemini 4 Carbon cybersecurity performance now leads three named benchmarks: 88.2% on SEC-bench Pro for finding bugs, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching. The 33-point drop from finding to exploiting is the most honest number in the release. Google has not published the method behind any of the three scores.

What did Google announce with Gemini 4 Carbon?

Google announced Gemini 4 Carbon on Wednesday, 28 October 2026, naming cybersecurity and long-horizon work as its headline capabilities. Koray Kavukcuoglu, senior vice president of Google DeepMind and Google’s chief AI architect, said the model shows ‘significant gains across coding and agentic tasks’ and claims ‘a firm lead’ on three security benchmarks:

• SEC-bench Pro: 88.2% for finding vulnerabilities
• ExploitGym: 54.8% for exploitation
• CWE-bench: 71.0% for patching

Google describes ‘significant performance improvements across the board’ in vulnerability detection, validation and remediation. Every AppSec program runs that loop: find, confirm, fix. Attackers run the same loop, minus the fix.

Carbon shipped less than a week after Gemini 4 Argon. With two frontier releases in six days, any model evaluation your team ran last quarter already describes an older product.

The Hacker News reported Carbon on 29 October alongside OpenAI’s GPT-6.1 Terra, which OpenAI rates Critical for cybersecurity, and an Anthropic disclosure of model-found vulnerabilities in Chrome, Safari, Android and Windows HTTP.sys. Both change the planning question more than Carbon’s scores do.

Why is ExploitGym at 54.8% when finding scores 88.2%?

Finding a bug and turning it into a working exploit are different jobs, measured here with different task sets and scoring rules. A discovery benchmark rewards pointing at the right flaw. An exploitation benchmark requires a primitive that works in a specific environment, against specific mitigations, from a specific starting state.

Anyone who has built exploits on a real engagement knows the drop-off. Spotting that a parser mishandles a length field can take an afternoon. Turning that into reliable code execution can take a week, or never happen, because the allocator, the sandbox or the build flags break the chain. A 33-point gap fits that reality, and Google is not alone in it.

Two warnings before repeating these numbers to leadership:

• The percentages are not stages of one pipeline. Multiplying 88.2% by 54.8% does not give an end-to-end success rate. Each benchmark has its own targets and its own definition of success.
• The method is not in the announcement. A security benchmark result means little without the task set, scaffolding, tools, retry limits, time and compute budgets, and scoring rules. The announcement, as reported, publishes none of these and cites no independent reproduction.

The field is not new: DARPA’s AI Cyber Challenge and Google’s own Big Sleep project had already shown automated systems finding real bugs in open-source code. Carbon claims a lead over rivals, not a new category of work.

If a board member forwards 88.2% as proof that AI now finds almost every bug, the accurate reply is narrower: Carbon solved 88.2% of one benchmark’s tasks, under conditions Google has not published.

How does Gemini 4 Carbon rank against Opus 5.5, GPT-6 Astra and GPT-6.1 Sol?

On the Artificial Analysis Intelligence Index, Carbon scores 59, one point ahead of Anthropic’s Claude Opus 5.5 and two ahead of OpenAI’s GPT-6 Astra.

Model	Artificial Analysis Intelligence Index
Gemini 4 Carbon	59
Claude Opus 5.5	58
GPT-6 Astra	57
GPT-6.1 Sol	55

That index is a general capability composite, not a pentest result. For procurement, a one-point lead is a tie. It does not make an existing contract built on Opus 5.5 or GPT-6 Astra obsolete.

Tooling moves results more than gaps this small. In a September 2026 black-box benchmark against OWASP Juice Shop that we covered, a general model connected to Burp Suite through MCP beat every autonomous pentest agent tested. Expect the same with Carbon: your score depends on what you connect it to.

Does Gemini 4 Carbon write secure code and resist prompt injection?

Google says Carbon is twice as likely as Gemini 4 Argon to generate secure code, without publishing Argon’s baseline rate or the test method. Relative claims hide absolute risk: if Argon hypothetically wrote secure code 30% of the time, doubling that would still leave four insecure outputs in ten. Until real numbers exist, AI-generated code should pass the same review, SAST and test gates as human-written code.

Google also says that on complex or high-pressure tasks, Carbon asks a human for input when the situation is ambiguous, rather than ‘guessing or forcing a path forward’. That would address a failure mode we see often in agentic testing: an agent hits a blocker and improvises around a control. But someone has to answer those questions, and an approval step that gets rubber-stamped is just a slower bypass.

Then comes the claim buyers will repeat in risk committees: Carbon ‘resisted every evaluated attack attempt at indirect prompt injection’. OWASP lists prompt injection as LLM01 in its 2025 Top 10 for LLM applications. The indirect form hides instructions in a webpage, document, email or tool output, which the model then treats as commands.

The key word is evaluated. The attack corpus, the model’s available tools and the success criteria are unpublished. ‘Every evaluated attempt’ describes a test set, not the content your agent will read tomorrow.

Injection damage comes from what the model can do: the repository it can push to, the browser session it holds, the cloud credentials in its environment. Our prompt injection testing works through that surface one input path at a time.

Who can use Gemini 4 Carbon, and what is the Fairwind Program?

Most security teams cannot use Carbon yet. Google is giving access first to a subset of cyber defenders, then to other trusted partners through its Fairwind Program. The announcement, as reported, gives no eligibility criteria, pricing or timeline. Google also says it takes part in the U.S. government’s voluntary pre-release testing process, but named no agency or framework and disclosed no results.

In Europe, providers of general-purpose AI models classified as posing systemic risk under the EU AI Act must evaluate and adversarially test the model, mitigate systemic risks, report serious incidents and maintain cybersecurity protections. Nothing in the announcement says Carbon carries that classification, and your obligations as a deployer do not shrink because the provider ran tests you cannot see.

Do not build a 2027 roadmap around Carbon access. If a vendor says its product is ‘powered by Carbon’, ask three things. Are they in Fairwind? Which model version do they run? What happens to your service if Google changes the terms on a restricted model?

What did OpenAI and Anthropic disclose the same week?

OpenAI released GPT-6.1 Terra as a fast, efficient model that ‘excels at communication and computer-based tasks’. OpenAI says Terra ‘meets the Critical threshold in cybersecurity under our Preparedness Framework, and maintains the protections developed for GPT-6 Astra’. It also says Terra is more likely than GPT-5.6 Terra to stay in scope and disclose its limitations honestly, and that it showed strong resistance in OpenAI’s own prompt-injection tests.

Critical is OpenAI’s own label for high cyber capability under its own framework, not a deployment ban or an external certification. Our read of the GPT-6.1 Terra system card found that Terra’s headline count of severe flags fell, yet it flagged more often than GPT-6.1 Sol and GPT-6 Astra for inbound prompt injection, exfiltration and destructive action.

Earlier the same week, Anthropic said an unreleased internal research model had found critical vulnerabilities in widely used software:

• A one-click remote code execution flaw in Google Chrome
• A one-click exploit chain in Apple Safari that could expose browsing history, cookies and other sensitive data
• An Android lock screen bypass
• A denial-of-service flaw in the Windows HTTP.sys driver, CVE-2026-33096, CVSS 7.5

Google, Apple and Microsoft have fixed all four, and the reporting does not mention exploitation in the wild. Anthropic’s framing is blunt: ‘These skills have historically been the domain of few specialist teams with expertise in these targets. Now, it’s something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify.’

Keep HTTP.sys in proportion: CVE-2026-33096 can take a listener down, but it is not reported as code execution. We covered the broader shift in AI models that find and exploit zero-days.

What should security leaders decide about Gemini 4 Carbon now?

The decision this quarter is not which frontier model to buy. It is whether your patching, vulnerability intake and agent governance can keep up with models that produce working exploits. Concretely:

1. Verify the four fixes across your fleet. Check Chrome, Safari, Android and Windows builds against the vendor advisories, and report ‘patch available’ and ‘patch deployed’ as separate numbers. Inventory HTTP.sys services, starting with IIS hosts.
2. Prepare intake for more AI-generated bug reports. Require reproducible artifacts, deduplicate by root cause and record the model and tool versions behind each submission. Bug bounty and PSIRT queues will feel the increase first.
3. Ask benchmark questions during procurement. When a tool cites Carbon, Terra or Opus 5.5 scores, ask which task set, which scaffolding, how many retries, what time and compute budget, and whether anyone outside the vendor has reproduced the result.
4. Scope agents by their tools, not their model card. List what each deployed agent can reach: repositories, network egress, browser sessions, cloud credentials, signing keys. That list is your prompt-injection blast radius.
5. Price in the shrinking patch window. Exploit development is getting cheaper for whoever holds these models, so patch SLAs written for human-speed attackers become a business risk. Raise that with your insurer and auditors now.

Practitioner’s note

On AI-assisted engagements, we treat every model-generated finding as untrusted input until it reproduces in isolation: a fixed version, the exact build, a minimized test case and clean sanitizer evidence. A working proof of concept shows the bug is reproducible. It does not show that your production system is exposed or that anyone has exploited it. That is why our AI agent penetration testing starts from an agent’s permissions, not its benchmark scores.

What is still unknown about Gemini 4 Carbon?

Much of what a risk committee would need is still missing:

• The task sets, scaffolding, retry limits and budgets behind the SEC-bench Pro, ExploitGym and CWE-bench scores
• Argon’s absolute secure-code rate, and how ‘secure’ was scored
• The indirect prompt-injection attack corpus, and the tools the model could use during testing
• Fairwind eligibility, timeline and contract terms
• Which U.S. government body tested Carbon, and what it found
• Whether Anthropic’s unreleased research model will ever ship, and under what controls

Until Google publishes more, Carbon is a credible signal about where the field is heading and an unverified claim about how far it has come.

FAQ

What benchmarks did Google cite for Gemini 4 Carbon?

SEC-bench Pro at 88.2% for finding vulnerabilities, ExploitGym at 54.8% for exploitation and CWE-bench at 71.0% for patching. Google published no task sets, scaffolding, scoring rules or independent reproduction.

Is Gemini 4 Carbon better than Claude Opus 5.5?

Carbon scores 59 to Opus 5.5's 58 on the Artificial Analysis Intelligence Index. A one-point gap on a general index is effectively a tie and says little about performance in a real security toolchain.

Can my security team use Gemini 4 Carbon today?

Probably not. Access goes first to a subset of cyber defenders, then to trusted partners through the Fairwind Program, with no published eligibility criteria or general availability date.

Did Google prove Carbon blocks indirect prompt injection?

No. Google says Carbon resisted every evaluated attempt, but the attack set and test conditions are unpublished, so test your own integrations before relying on it.

You may not get Carbon access this year, but the apps, tools and agents you build on Gemini, Claude or GPT still need testing. agent::offense tests them the way an attacker would, starting from their tools and permissions. See our LLM application penetration testing.